Disclaimer: This information is posted as-is and the content should be referenced at your own risk.

This article outlines the high-level steps involved in moving devices from ‘Device Admin’ management to Android Enterprise. For details on setting up Android Enterprise, please refer to the Sophos Mobile admin guide.

 

Android Enterprise replaces ‘Device Admin’

‘Device Admin’ is the former mode of managing Android devices. Google encourages all customers to now use its successor, Android Enterprise, which is fully supported in Sophos Mobile.

For some background information on Android Enterprise, please see this article.

 

Moving from ‘Device Admin’ to Android Enterprise

Devices that are currently managed in ‘Device Admin’ mode can be re-enrolled in Android Enterprise management. The enrolment method and options depend on whether the device is going to be in ‘Full Device Management’ or ‘Work Profile’ mode.

Enrolling in Android Enterprise Full Device Management

Enrolling a device in Android Enterprise Full Device Management requires a new or wiped device. Customers can move as part of the device lifecycle refresh or by factory resetting existing devices.

Note: A factory reset can be done remotely via the ‘Wipe’ command in Sophos Mobile

Enrol devices via one of the below methods:

• Add device wizard – select a user, create a new device, and assign a task bundle that includes an Android Enterprise Full Device policy – enrol the device by entering the afw#sophos credentials
• Sophos Self service portal – a user logs into the Self Service portal, registers a new device and receives information on how to enrol using the afw#sophos credentials
• QR code enrolment – start the device and scan a QR code to begin enrolment
• Zero-touch enrolment – devices are configured to automatically enrol when switched on

 

Note: The Sophos Mobile admin guide provides more specific details on each of these options. Please refer to this for further information.

 

 

Enrolling in Android Enterprise Work Profile

Enrolling in Android Enterprise Work Profile does not require a factory reset, but it does require the existing ‘Device Admin’ management to be removed.

• Locate device in the Sophos Mobile console – select Actions> Unenroll
• Delete the device (this avoids duplication when the device is re-enrolled) – select Actions> Delete

Note: Now the Sophos Mobile Control app is still installed, but the device is no longer managed

Re-enrol the device via one of the below options:

• Add device wizard – select a user, create a new device, and assign a Task Bundle that includes a Work Profile policy. On the device, open the Sophos Mobile app and scan the QR code to set up the Work Profile
• Sophos Self service portal – a user logs into the Self Service portal, registers a new device and receives information on how to scan the QR code and set up the Work Profile

Note: The Sophos Mobile admin guide provides more specific details on each of these options. Please refer to this for further information.

Updated
[edited by: tom_w at 11:10 AM (GMT -7) on 6 Oct 2020]